Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 01:08
Static task
static1
Behavioral task
behavioral1
Sample
c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe
Resource
win10v2004-20220812-en
General
-
Target
c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe
-
Size
95KB
-
MD5
5be4f80f98b3afc692b804018cda6702
-
SHA1
dd2c4b52512e6db057f560494fbaec5fc7cc1100
-
SHA256
c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476
-
SHA512
1f43de6b6667ecb380951e4774a1c902055a9a7fca49af411e662a389921d50e8c0ec8d77b2b6343799df01f4afb320888fdb792ae006d0dc0de71e27c3436b1
-
SSDEEP
1536:0T3KuCzqahhTbcG0yZnFi0Seu9+2aLWdaAQzqj3D7QpHoSp7wpvFIy:Rc0S/9wCdaxzqj3DEeSCpvFIy
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2004 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1060 wrote to memory of 2004 1060 c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe 27 PID 1060 wrote to memory of 2004 1060 c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe 27 PID 1060 wrote to memory of 2004 1060 c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe 27 PID 1060 wrote to memory of 2004 1060 c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe"C:\Users\Admin\AppData\Local\Temp\c84b33a74e59ad2fe103d9d64af4afd2363baef8a8b35dc1ca3e43a7c89d9476.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Udj..bat" > nul 2> nul2⤵
- Deletes itself
PID:2004
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274B
MD570cac3b53f9771afe9b59d1c2331221f
SHA1e50ffda184ce573ac0bbce63e71f58ddf37caed4
SHA256138fd6928f6eed3cc9586723a283ec9ef065506e0697a9e6d54092ac43ac327f
SHA512b4dd384dce8bde273d91f750b06163f5cdc2a98706c80b64e2f66477f5923142f6e7a178fec7801fa754a037260b8b80ee4ea8cded20b5fcadcfeb02d1f62b38